Most organisations are running the AI race without knowing what they’ve already put on the track. Hanna Linderstål opened VERGE: Comprehensive Security with a simple way to fix that.

Hanna Linderstål started with a question. She asked a full room at Epicenter Stockholm to raise their hand if they knew how many AI agents were running in their organisation.

Four hands went up.

That moment set the tone for the afternoon at VERGE: Comprehensive Security. We are in an AI race, and Hanna was clear that she wasn’t there to talk about stopping it. She was there to talk about brakes. Not to slow innovation down, but because nobody wants to drive a Porsche fast without them.

The headless race

Hanna calls it “the headless race”. Organisations are adopting AI faster than they can understand it, in a world that looks very different from a few years ago.

State-linked attackers have stayed hidden inside companies for months before anyone noticed. New hacker groups with a geopolitical agenda now target ordinary companies and municipalities, not just governments. Before the invasion of Ukraine in 2022, everyday systems such as shop surveillance cameras were hijacked and turned against the public.

At the same time, we are connecting old systems, often carrying years of security debt, to IoT devices and AI. Every new connection opens new vulnerabilities, and the risk is carried by society as a whole.

Democracies are slow by design. Technology is not. Hanna’s warning was that decisions and power are quietly moving into systems that few people understand.

Your newest employee

The line many people took home: your newest employee isn’t the person you met by the coffee machine. It’s the AI agent someone installed without telling you.

That employee has access to email and core systems. Nobody did a background check. Nobody knows what data it was trained on, or who is responsible for stopping it if it does something it shouldn’t.

Hanna believes the next big breach will come through AI agents. Not necessarily through malice, but through what she calls the clueless criminal: agents that make mistakes, leak data by accident or delete things nobody asked them to delete. Many organisations are rolling out agents. Far fewer have mature governance for them.

Her conclusion was blunt. Without an inventory, you can’t have a strategy for a safe AI journey.

Built for the audit, not the crisis

Many organisations covered by DORA, NIS2 and other EU regulation are preparing for one thing: the next audit. Hanna challenged the room to stop optimising for the auditor and start building organisations that actually hold up.

The same goes for how AI is sold internally. Using AI to cut heads and costs is not innovation, she argued. Saving money is just saving money. Real innovation is building robust organisations that can grow and make society better.

Four brakes worth building

Hanna closed her keynote with four principles:

1. Get to know your agents. You already have them. Know what they are, what they can access and who can switch them off.
2. Design your AI strategy for failure. Expect things to go wrong. If you build for failure, you have built the brakes into the car. Then you can drive fast.
3. Choose your dependencies. Procure with geopolitical glasses on. Ask where a system comes from, which laws it sits under and where that could lead.
4. Invest in human judgment. Keeping a human in the loop isn’t enough when AI produces more code than anyone could ever read. Invest instead in judgment about where systems are used and how data flows.

Could you run your company without internet?

In the fireside conversation that followed, the questions got practical. If the cables were cut and you lost internet for five days, could you run your AI models? Could you run your company at all?

For most, the honest answer is no. Hanna’s point wasn’t to frighten anyone. It was to ask: what is your redundancy, and have you practised it?

She also named a national weakness. Swedes, she said, have become house cats: laid back, trusting and expecting everything to work. The world has changed, and that trust needs to be matched with preparation. She pointed to Ireland and the UK as countries that set clearer demands on organisations.

And to leaders worried that all these warnings lead to paralysis, she had a clear answer. Avoiding AI is not a strategy either. That’s like keeping a horse and carriage on the motorway.

What to do on Monday

• Make an inventory of the AI agents in your organisation: what they do, what they can access and who owns them.
• Identify your critical processes, whether you are a one-person company or have thousands of employees.
• Make sure there is a backup for the backup.
• Run crisis exercises every month, not every third year.
• Ask your CEO and CISO one question: do we have an AI agent strategy?

About the speaker

Hanna Linderstål works at the intersection of cybersecurity, AI and geopolitics, advising organisations in both the private and public sector. She is behind Alliance for Cybersecurity for Municipalities, a network for sharing knowledge on safe AI transformation, which is now being extended to businesses.

This article is part of VERGE Pulse, a series of insights from VERGE: Comprehensive Security at Epicenter Stockholm on 19 October 2026. VERGE is Epicenter’s flagship event series, bringing founders, leaders, investors and experts into one room to explore the questions that will shape the next decade.

Want to talk about resilience in your own organisation, or shape the next VERGE with us? Get in touch with the Epicenter team.